Abstract: A wireless device association apparatus includes a sensor having a wireless traffic analyzer that is configured to detect a wireless signal from a first wireless device. A wireless interface is configured to send a first fingerprinted data sequence to the first wireless device and is configured to detect a second fingerprinted data sequence received at a second wireless device. A processor is configured to correlate a first signature derived from the first fingerprinted data sequence and the second signature derived from the second fingerprinted data sequence to determine an association between the first and second devices.

Abstract: A system and method of wireless device location mapping comprising measuring a signal strength of a wireless signal generated by the wireless device at a plurality of sensor devices positioned at a plurality of sensor locations; determining a range from each of the plurality of sensor devices to the wireless device based on the measured signal strength; and generating a plurality of ranging spheres, a respective one of the plurality of ranging spheres corresponding a respective one of the plurality of sensor devices and being centered at a respective one of the plurality of sensor locations and having a radius that is proportional to the determined range of the respective one of the plurality of sensor devices to the wireless device.

Abstract: A method of direction-aware device location includes establishing a region of interest comprising a plurality of wireless devices. A reference frame is then determined based on the established region of interest. A plurality of initial positions of the plurality of wireless devices is determined. A plurality of wireless signal strengths is measured as a function of time at each of the plurality of wireless devices. A topology of the plurality of wireless devices is determined as a function of time based on the plurality of measured wireless signal strengths as a function of time and the reference frame for each of the plurality of devices. Location and movement information is then determined as a function of time for each of the plurality of wireless devices based on the determined topology as a function of time.

Abstract: A method of wireless device location determination includes defining a region of interest comprising a plurality of sensors. A reference frame and a grid comprises a plurality of simulation points with locations based on a coordinate system associated with the region of interest. Location coordinates for the plurality of sensors are established. A plurality of simulated wireless signal strengths is determined for each simulation point. A plurality of simulated signal strength matrix is generated using the plurality of simulated wireless signal strengths. A composite matrix is generated based on the plurality of simulated signal strength matrices. Wireless signal strength is measured at each of the plurality of sensors based. A measured wireless signal strength vector is then generated based on the measured wireless signal strength. A location of the intrusive device is then determined based on the measured wireless signal strength vector and the composite matrix.

Abstract: A method of managing devices that monitor and protect a distributed network includes obtaining a peer topology and master-selection rules at each of a plurality of peer devices. A master device at each of the plurality of peer devices is selected using the peer topology and master-selection rules. Device management information and operation information is received at the master. Updated master-selection rules and updated peer topology is obtained. The master sends to each of the plurality of peer devices tasking and task updates. The plurality of peer device reports is generated based on the tasking and is received at the master. A master report is generated based on the plurality of reports. A new master device is selected from the plurality of peer devices based on a determination of whether the master device is disconnected.

Abstract: A method of identifying a device positioned in a network and making domain assignments includes instantiating a network comprising an offsite server and a plurality of trusted devices positioned in at least two different domains. A plurality of local network graphs is generated for at least some of the plurality of trusted devices positioned in the at least two different domains. At least some of the plurality of local network graphs is transmitted to the offsite server. A probability that at least some of the plurality of trusted devices is positioned in the same domain is determined from the plurality of local network graphs. Trusted devices are assigned to domains based upon the determined probabilities. Domain assignments are updated for at least some of the plurality of trusted devices based upon the assignments of trusted devices to the domains.

Abstract: A system and method for performing a security audit of a target network. The system includes a device that establishes a connection to the target network through a communication link. The device has reverse tunneling capabilities for establishing a secure tunnel over the Internet. The system also includes a receiving computer connected to the device through the secure tunnel established by the device over the Internet, and the receiving computer sends commands to the device for performing the security audit of the target network. The device is deployed onsite near the network and the receiving computer is located at a remote offsite location. Also, the device may be covertly hidden onsite near the network to simulate a malicious attack on the target network.

Abstract: A system and method for performing a security audit of a target network. The system includes a device that establishes a connection to the target network through a communication link. The device has reverse tunneling capabilities for establishing a secure tunnel over the Internet. The system also includes a receiving computer connected to the device through the secure tunnel established by the device over the Internet, and the receiving computer sends commands to the device for performing the security audit of the target network. The device is deployed onsite near the network and the receiving computer is located at a remote offsite location. Also, the device may be covertly hidden onsite near the network to simulate a malicious attack on the target network.